Ask a messaging vendor whether their product is secure, and the answer will likely open with encryption. Ask the question the way a CJIS auditor will ask it, and the answers change.
The FBI rebuilt the Criminal Justice Information Services (CJIS) Security Policy in December 2024 around the National Institute of Standards and Technology (NIST) SP 800-53 control families. The current release, CJIS Security Policy v6.1, published June 25, 2026, carries 20 policy areas, and 18 of them are those families.
Encryption accounts for multiple controls inside one family. The rest cover whose identity was actually verified, what the system wrote down, how long that record lasts, and who can change it.
Buying a product or service on the strength of its encryption alone means you’ve evaluated one control family out of 18 and are taking the rest on trust. Discussing CJIS audit preparation with a consultant can help you be prepared.
A Working Definition for Criminal Justice Use
Four requirements make messaging secure in a criminal justice setting:
- Content has to stay protected in transit and at rest, which is System and Communications Protection and the requirement most vendors lead with.
- Everyone on either end has to be individually identified, which Identification and Authentication (IA) verifies and Access Control then authorizes.
- Every access and transmission event should come with a record participants cannot edit or access without authorization, which is covered under Audit and Accountability (AU).
- That record has to outlive the case, which falls under Audit and Accountability again. This is where platforms with good logging and their own deletion schedule fail.
Consumer messaging applications often solve the first requirement and leave the other three untouched. In a criminal justice setting, the system has to survive an audit and an evidentiary challenge, and encryption settles only a small part of each.
What Encryption Does and Does Not Cover
Encryption protects content from interception while it moves and while it sits at rest. Within the System and Communications Protection (SC) are the relevant controls.
SC-8 covers the confidentiality and integrity of transmitted information, and its first enhancement requires cryptographic mechanisms that prevent unauthorized disclosure and detect unauthorized changes to criminal justice information in transit.
SC-28(1) handles information at rest outside a physically secure location. It calls for modules certified under Federal Information Processing Standard (FIPS) 140-3 at a symmetric strength of at least 256 bits, or FIPS 197 at 256 bits. SC-13 specifies the cryptography required for CJI in transit.
The version number matters, because on Sept. 22, 2026, the NIST Cryptographic Module Validation Program (CMVP) will move every remaining FIPS 140-2 certificate to historical status. CMVP says federal agencies should not include historical modules in new procurements, while leaving them free to make a risk determination about modules already in use.
SC-8 and SC-28(1) can both be met in full, and encryption still says nothing about who authenticated on the far end. Its protection ends at decryption, where screenshots, copies into unmanaged applications, and automatic backup to personal cloud storage happen.
A stolen credential could open a properly encrypted session for an unauthorized user, and the system would log it as routine because, by its own rules, it was routine.
Identity Is the Control That Carries the Weight
Advanced identity authentication verifies the user before any criminal justice information reaches the device. IA-2 requires individual identification and authentication of organizational users, with that identity tied to the processes acting for them.
IA-2(1) and IA-2(2) extend multi-factor authentication to privileged and non-privileged accounts. Both sit at Priority 1, auditable and sanctionable since Oct. 1, 2024.
Individual attribution determines evidentiary value. An audit trail that stops at a shared workstation account cannot support a finding about a person. Internal investigations and discovery disputes need exactly that.
IA-2 covers the moment of access. Account lifecycle is the Access Control (AC) half, and messaging platforms fail there quietly. AC-2(3), also Priority 1, requires disabling accounts within one week when they have expired, are no longer associated with a user, violate agency policy, or have been inactive for 90 days.
AC-2(13) compresses that timeline to 30 minutes for individuals discovered to pose a direct threat. A messaging product administered outside the agency’s directory turns both timelines into manual work. An officer who transferred out last month can remain a live identity in a group thread, and nothing in the platform will flag it.
Logging, Retention, and Audit Readiness
Every access and transmission event needs a record an auditor or a court can retrieve. AU-2 names the events a system has to log and applies the same qualifier to all of them, successful and unsuccessful. That covers log-on attempts, permission use across accounts and files, password changes, actions by privileged accounts, and any attempt to read, modify, or destroy the audit log itself.
AU-3 sets six elements for every record. What type of event occurred, when, where, the source, the outcome, and the identity of whoever or whatever was involved.
AU-11 requires audit records to be kept for at least one year, and then until they are no longer needed for administrative, legal, audit, or other operational purposes. The control names Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions.
AU-9 turns the same scrutiny on the logs themselves, requiring that audit information and logging tools be protected from unauthorized access, modification, and deletion, with an alert to security personnel when any of that happens.
AU-9(4) narrows management of audit logging to a defined subset of privileged users, since someone who might become the subject of an audit should not also control the audit machinery. Write-once storage and a split between platform administration and audit review satisfy both, and the OpenFox Archive holds the resulting records for long-term search and retrieval.
Where Consumer Apps Create Audit Exposure
Personal devices carrying agency conversations may sit outside any mobile device management the agency operates. Without proper protections, there is no remote wipe, no screen lock enforcement, and no separation between agency and personal content when a device is seized.
Disappearing message settings run against AU-11 and the FOIA and subpoena obligations it names. Cross-agency group threads distribute criminal justice information to recipients whose access nobody authorized under AC-2, and reconstructing the basis afterward is not realistic.
A private contractor with access to criminal justice information operates under the CJIS Security Addendum in Appendix H, a uniform addendum approved by the Director of the FBI under 28 CFR 20.33(a)(7). Contractor personnel sign an acknowledgment the agency keeps available for audit, and contractors performing criminal justice functions must meet the same training and certification criteria as government personnel under the same audit review.
IR-6 adds a clock, requiring suspected incidents to be reported within one hour of discovery.
Evaluating a Platform for Agency Use
When talking to a vendor, have them trace a message from composition through delivery, with the resulting AU-3 record on screen. Post a separation in a test directory and time how long the account stays live against the one-week AC-2(3) allows. Ask for a one-year audit export in a form a prosecutor could hand to defense counsel. Then ask for the signed Security Addendum certification page and the incident notification terms in the contract.
CPI OpenFox has been supporting criminal justice agencies since 1989, and the OpenFox Message Switch moves criminal justice information for 31 states and thousands of agencies through the National Crime Information Center (NCIC) and Nlets, under the same control families an auditor will apply to a messaging platform.
To review how your agency’s messaging and information sharing hold up against version 6.1, request a consultation with CPI OpenFox.
